updated sql queries to protect against sql injection